CVE-2026-26030: 
Semantic Kernel vulnerability analysis and mitigation

CVE-2026-26030 is a critical Remote Code Execution (RCE) vulnerability in Microsoft's Semantic Kernel Python SDK, specifically within the InMemoryVectorStore filter functionality. It affects all versions of the semantic-kernel pip package prior to 1.39.4. The vulnerability was published on February 19, 2026, with the fix released on February 10, 2026 (python-1.39.4), and formally acknowledged by Microsoft's MSRC on March 10, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, MSRC).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection): the InMemoryVectorStore filter functionality evaluates user-influenced filter expressions without adequately neutralizing dangerous attribute names or constructs, allowing arbitrary Python code to be injected and executed server-side (GitHub Advisory). The fix, introduced in PR #13505, blocks the use of dangerous attribute names that must not be accessed in filter expressions (GitHub PR). Exploitation requires network access and low-level authentication (PR:L), but no user interaction, and the scope change (S:C) indicates impact can extend beyond the vulnerable component itself. A public PoC (exploit.py) demonstrates the vulnerability locally by passing a malicious filter expression to the vulnerable library (PoC GitHub). The vulnerability has also been discussed in the context of prompt injection enabling RCE in AI agent frameworks (Microsoft Security Blog).

Successful exploitation allows an authenticated network attacker to execute arbitrary code with the privileges of the application process, resulting in full compromise of confidentiality, integrity, and availability. Because the CVSS scope is "Changed," impact can extend to systems and data beyond the vulnerable Semantic Kernel instance itself, enabling lateral movement within AI agent pipelines or connected infrastructure. Sensitive data processed by the SDK — including vector store contents, embeddings, and any secrets accessible to the process — may be exposed or tampered with (GitHub Advisory, MSRC).

A public proof-of-concept exploit (exploit.py) is available on GitHub, targeting semantic-kernel==1.39.0 and demonstrating arbitrary code execution via unsafe filter expression evaluation (PoC GitHub). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.089% (low probability of near-term exploitation), and the vulnerability does not appear in the CISA KEV catalog. The vulnerability was included in Microsoft's March 2026 Patch Tuesday review (Tenable Blog).

1. Reconnaissance: Identify applications using the semantic-kernel Python package (pip) at versions prior to 1.39.4, particularly those exposing InMemoryVectorStore functionality to network-accessible endpoints or AI agent pipelines.
2. Obtain low-privilege access: Acquire any authenticated session or API key that allows interaction with the application's vector store query or filter interface (PR:L — low privileges required).
3. Craft malicious filter expression: Construct a filter expression containing a Python code injection payload targeting the unsafe evaluation path in InMemoryVectorStore. The PoC uses a payload that exploits the lack of sanitization on attribute names in filter expressions (e.g., referencing __class__.__init__.__globals__ or similar dangerous attributes).
4. Submit payload: Send the crafted filter expression to the vulnerable endpoint via a network request (e.g., an API call that triggers InMemoryVectorStore filtering).
5. Achieve RCE: The injected expression is evaluated server-side without sanitization, executing arbitrary Python code in the context of the application process — enabling reverse shell, data exfiltration, or further lateral movement (PoC GitHub, GitHub Advisory).

• Process: Unexpected child processes spawned by the Python process running Semantic Kernel (e.g., /bin/sh, bash, curl, wget, python3 -c) that are not part of normal application behavior.
• Logs: Application logs showing unusual or malformed filter expressions passed to InMemoryVectorStore queries; Python tracebacks or eval-related errors in application logs.
• Network: Unexpected outbound connections from the Semantic Kernel application host to external IPs or C2 infrastructure following vector store filter operations.
• File System: New or modified files in the application directory or temp directories created by the application process user; unexpected scripts or binaries dropped post-exploitation.
• Environment: Evidence of access to environment variables, secrets, or credentials files by the application process outside of normal operation patterns.

Upgrade the semantic-kernel pip package to version 1.39.4 or higher, which blocks dangerous attribute names in filter expressions (GitHub Release, GitHub Advisory). As an interim workaround for those unable to upgrade immediately, avoid using InMemoryVectorStore in production scenarios (GitHub Advisory). Additionally, restrict network access to Semantic Kernel-based services and apply least-privilege principles to limit the blast radius of any exploitation.

Microsoft's Security Response Center formally acknowledged the vulnerability on March 10, 2026, and it was included in the March 2026 Patch Tuesday review by multiple security vendors including Tenable, Rapid7, Sophos, and Zero Day Initiative (Tenable Blog, Rapid7). Microsoft published a dedicated security blog post in May 2026 titled "When Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks," contextualizing CVE-2026-26030 within the broader risk of prompt injection enabling RCE in AI pipelines (Microsoft Security Blog). A technical deep-dive blog post titled "AST-filtered eval is not a sandbox" was published in March 2026, and the vulnerability was discussed on Hacker News and Reddit, generating community interest around the security risks of unsafe eval patterns in AI frameworks. The SANS Internet Storm Center also covered the vulnerability in its diary (SANS ISC).